This vulnerability (CVE-2026-5782) in Loglama.net TurkHotspot is due to improper input neutralization during web page generation, leading to reflected cross-site scripting (CWE-79). It allows an attacker to inject malicious scripts that are reflected back to users, potentially impacting confidentiality and integrity. The affected versions include all releases up to and including 2026-10-02. The vendor has not provided a response or patch. The CVSS 3.1 vector is AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, indicating an attack requiring adjacent network access, low attack complexity, no privileges, user interaction required, and partial confidentiality and integrity impact without availability impact.

Successful exploitation can lead to partial confidentiality and integrity loss due to reflected XSS attacks. This may allow attackers to execute scripts in the context of the victim's browser, potentially stealing sensitive information or performing unauthorized actions. There is no known active exploitation in the wild. Availability is not affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is available, users should consider implementing web application firewall (WAF) rules to detect and block reflected XSS payloads and apply input validation and output encoding as interim mitigations.